• http://framework.zend.com/downloads/latest

This is the first stable release in the 2.2 series.

Usability and Consistency

The primary focus of the 2.2 release has been usability and consistency, primarily with regard to creation and configuration of services such as hydrators, input filters, logs, DB connections, cache objects, translators, and forms.

Most of these services now have what are known as "Abstract Factories" that are either registered by default, or can be added quickly to your application configuration. Abstract factories are used by the service manager when you have multiple services that follow the same instantiation pattern, but which have different names. The typical pattern the new abstract factories follow is to use key/configuration pairs under a common top-level configuration key to describe the instances desired:

<?php
'log' => array(
    'Application\Log' => array(
        'writers' => array(
            array(
                'name'     => 'stream',
                'priority' => 1000,
                'options'  => array(
                    'stream' => 'data/logs/app.log',
                ),
            ),
        ),
    ),
),

The above creates a logger named "Application\Log" which you can retrieve directly from the service manager. If you wanted to have additional loggers, you could do so by adding additional entries under the "log" heading, each named, and each providing configuration for a logger.

Besides the logger abstract factory illustrated above, the following components each have abstract factories now, too, using the configuration keys noted:

• Zend\Cache: "caches" configuration section, allowing multiple named cache storage objects.
• Zend\Db: "adapters" subkey of the "db" configuration section; this abstract factory allows you to finally have multiple named DB adapter instances, effectively allowing for read-only and write-only connections.
• Zend\Form: "forms" configuration section (which makes use of several old and new plugin managers, as noted below).

A number of new plugin managers were also added. Plugin managers are specialized service manager instances used by objects that will be consuming many different related object instances, often based on runtime conditions. As examples, view helpers and controller plugins are mediated by plugin managers.

The new plugin manager instances include:

• Zend\Stdlib\Hydrator\HydratorPluginManager, for retrieving hydrator instances. This allows re-use of individual hydrators, and coupled with the forms abstract factory, allows usage of custom hydrators across your form instances.
• Zend\InputFilter\InputFilterPluginManager, for retrieving (configurable) input filter instances. This allows re-use of input filters, as well as ensures that all input instances are provided with custom validators and/or filters (from the existing validator and filter plugin managers). The forms abstract factory makes use of this, which allows us to finally tie together the various plugin managers to create fully configurable and custom forms.

Finally, a couple new service factories were created. Service factories usually have a 1:1 relationship between the named service and the instance provided, and are ideal for situations where you only need one instance of a given service type. In the case of the new factories for 2.2, these include translators and sessions.

Data Definition Language Abstraction

Zend Framework 2.2 also offers initial support in Zend\Db for dynamic DDL queries. DDL, for Data Definition Language, is a subset of SQL that comprises different commands for building RDBMS data structures like tables, columns, constraints, indexes, views, triggers and the like.

Initial support is limited to creating tables with SQL92 data-types, and some specialization for MySQL support. Here is an example of CREATE TABLE statement:

<?php
    use Zend\Db\Sql\Sql;
    use Zend\Db\Sql\Ddl;

    $t = new Ddl\CreateTable();
    $t->setTable('bar');
    $t->addColumn(new Ddl\Column\Integer(
        'id', 
        12, 
        true, 
        null,
        ['auto_increment' => true, 'comment' => 'Some comment']
    ));
    $t->addColumn(new Ddl\Column\Varchar('name', 255));
    $t->addColumn(new Ddl\Column\Char('foo', 20));
    $t->addConstraint(new Ddl\Constraint\PrimaryKey('id'));
    $t->addConstraint(new Ddl\Constraint\UniqueKey(
        ['name', 'foo'],
        'my_unique_key'
    ));

    $sql = new Sql($adapter);
    echo $sql->getSqlStringForSqlObject($t);

Once this table is created, it can then be altered:

<?php
    $t = new Ddl\AlterTable('bar');
    $t->changeColumn('name', new Ddl\Column\Varchar('new_name', 50));
    $t->addColumn(new Ddl\Column\Varchar('another', 255));
    $t->addColumn(new Ddl\Column\Varchar('other_id', 255));
    $t->dropColumn('foo');
    $t->addConstraint(new Ddl\Constraint\ForeignKey(
        'my_fk', 'other_id', 'other_table', 'id', 'CASCADE', 'CASCADE'
    ));
    $t->dropConstraint('my_index');
    echo $sql->getSqlStringForSqlObject($t);

Or even dropped:

<?php
    $dt = new Ddl\DropTable('bar');
    echo $sql->getSqlStringForSqlObject($dt);

What can this be used for?

That is where you come in. This particular feature was asked for numerous times during ZF1 development. We'd like to see what kind of ZF2 modules can be created with this base infrastructure. Migration assistant? ORM database creation tool? Advanced CMS? Let us know; we'll be adding more vendor specific support over the 2.2 to 2.3 timeline.

New Service Wrappers

Zend Framework has a long history of providing API wrappers; in fact, they were a prominent part of the initial pre-release! The tradition continues in ZF2, though each API wrapper now has its own repository.

Alongside the 2.2.0 release, we're also providing initial beta releases of two new service components: ZendService_Api and ZendService_OpenStack.

ZendService_Api

This is an HTTP microframework for consuming generic API calls in PHP. This framework can be used to create PHP libraries that consume specific HTTP APIs using either a simple configuration array or files. This project uses the Zend\Http\Client component of Zend Framework 2. Enrico has blogged about the component previously.

ZendService_OpenStack

We began the development of a new library to support the last API version of OpenStack. The goal of this component is to simplify the usage of OpenStack in PHP, providing a simple object oriented interface to its API services. This component is based on ZendService_Api, giving us a flexible way to update the HTTP specification with the future API versions.

ZFTool Diagnostic Features

Artur Bodera (aka Thinkscape) provided a new diagnostics feature for ZFTool. Using this feature, we can allow the execution of customized diagnostics tests in ZF2 projects, including testing for the required PHP version, testing for specific PHP extensions, testing for specific ZF2 modules, testing for specific PHP INI settings, and more; read the documentation to get an idea of the variety of tests available.

Moreover, with the collaboration of the LiipMonitor project, we decided to create common interfaces for performing diagnostic tests in PHP applications. An initial draft is available in the ZendDiagnostic repository.

The diagnostics feature is available in the latest version of ZFTool.

Hydrator Improvements

As noted earlier, Zend\Stdlib\Hydrator now has a plugin manager you can compose into your objects for managing hydrator instances. However, beyond that, we also now have an "Aggregate Hydrator", which allows you to provide specialized mapping of your object types to hydrators via an event-based system.

Why is this exciting? Many of our users utilize Doctrine as an Object Relational Mapping (ORM) system. Oftentimes, the entities that you work with will also form a hierarchical structure. The Aggregate Hydrator allows allows you to attach a single hydrator to the parent object, and ensure that all child and descendant objects are either hydrated or extracted according to their type.

Reducing Dependencies

We have started work on a new story for the framework: reducing dependencies for individual components. We have received feedback from a number of developers and organizations indicating that even though each component can be installed individually, the number of dependencies most components mark as required leads to a situation where they feel they must choose whether or not they adopt the framework, versus adopting just the component. While of course we'd like them to adopt the framework, we'd rather they get a taste for it, if you will.

While this story is primarily slated for 2.3, we have made our first steps in 2.2, with the Zend\Feed and Zend\Validator components.

Zend\Validator removed its dependency on the i18n component. We achieved this by creating Separated Interfaces for the translator. Considering translation was only enabled if you explicitly injected a translator, this was a natural course of action. (It also introduced a minor backwards compatibility break; see below for more information.)

For Zend\Feed, many "required" dependencies were actually optional already, and we could mark them as such. There were two that were not, however, and which required similar treatment as Zend\Validator in creating separated interfaces: the service manager (used for extension management) and HTTP (for fetching remote feeds with the reader). Interfaces were developed for each of these, and Zend\Feed now has only two required dependencies. A nice side benefit is that you can now use third-party HTTP clients with Zend\Feed\Reader!

Migration Notes

While we have worked hard to keep code backwards compatible (BC), there are a few noteworth changes that may affect your code.

• Zend\Validator no longer directly consumes a Zend\I18n\Translator\Translator instance; instead, you must either implement Zend\Validator\Translator\TranslatorInterface or use Zend\Mvc\I18n\Translator. In most cases, this change should be transparent, as validator instances managed by the ValidatorPluginManager will already be using the correct instance.
• In 2.1.5, a BC break was accidently introduced into Zend\Navigation in order to enable a feature: MVC pages were altered to always use route match values when available when generating URIs. 2.2.0 was modified to add a flag to enable this behavior on demand, but defaults to the original behavior, which does not pass the route match values to the pages. If you relied on this behavior in 2.1.5, add the following option to your individual MVC page definitions:

  
  <?php
  'use_route_match' => true,
  
  
          

Other Notable Improvements

• Authentication: The DB adapter now supports non-RDBMS credential validation.
• Cache: New storage backend: Redis.
• Code: The ClassGenerator now has a removeMethod() method.
• Console: Incremental improvements to layout and colorization of banners and usage messages; fixes for how literal and non-literal matches are returned.
• Filter: New DateTimeFormatter filter.
• Form: Many incremental improvements to selected elements; new FormAbstractServiceFactory for defining form services; minor improvements to make the form component work with the DI service factory.
• InputFilter: new CollectionInputFilter for working with form Collections; new InputFilterPluginManager providing integration and services for the ServiceManager.
• I18n: We removed ext/intl as a hard requirement, and made it only a suggested requirement; the Translator has an optional dependency on the EventManager, providing the ability to tie into "missing message" and "missing translations" events; new country-specific PhoneNumber validator.
• ModuleManager: Now allows passing actual Module instances (not just names).
• Navigation: Incremental improvements, particularly to URL generation.
• MVC: You can now configure the initial set of MVC event listeners in the configuration file; the MVC stack now detects generic HTTP responses when detecting event short circuiting; the default ExceptionStrategy now allows returning JSON; opt-in translatable segment routing; many incremental improvements to the AbstractRestfulController to make it more configurable and extensible; the Forward plugin was refactored to no longer require a ServiceLocatorAware controller, and instead receive the ControllerManager via its factory.
• Paginator: Support for TableGateway objects.
• ServiceManager: Incremental improvements; performance optimizations; delegate factories, which provide a way to write factories for objects that replace a service with a decorator; "lazy" factories, allowing the ability to delay factory creation invocation until the moment of first use.
• Stdlib: Addition of a HydratorAwareInterface; creation of a HydratorPluginManager.
• SOAP: Major refactor of WSDL generation to make it more maintainable.
• Validator: New Brazilian IBAN format for IBAN validator; validators now only return unique error messages; improved Maestro detection in CreditCard validator.
• Version: use the ZF website API for finding the latest version, instead of GitHub.
• View: Many incremental improvements, primarily to helpers; deprecation of the Placeholder Registry and removal of it from the implemented placeholder system; new explicit factory classes for helpers that have collaborators (making them easier to override/replace).

Changelog

Greater than 150 patches were applied for 2.2.0.

• http://framework.zend.com/changelog/2.2.0

Other Announcements

Over a month ago, we migrated Zend Framework 1 to GitHub. At that time, we also migrated active issues created since 1.12.0 to the GitHub issue tracker, and marked our self-hosted issue tracker read-only. We have decided to turn off that issue tracker, but still retain the original issues at their original locations for purposes of history and transparency. You can find information on the change on our issues landing page.

Thank You!

Please join me in thanking everyone who provided new features and code improvements for the 2.2.0 release! We had a huge leap forward in usability of many components, and a number of key new features that make developing applications simpler. We'll be continuing on these themes for the next release as well.

Roadmap

Maintenance releases are scheduled for the third Wednesday of each month; expect 2.2.1 on 19 June 2013. Minor releases are scheduled roughly every quarter; look for 2.3 sometime around mid-August or early September. Proposals and ideas for stories will be presented on the zf-contributors mailing list; subscribe by sending an email to zf-contributors-subscribe [at] lists.zend.com if you are interested in assisting with its development.

• http://packages.zendframework.com/

This is a release candidate. It is not the final release, and while stability is generally considered good, there may still be issues to resolve between now and the stable release. Use in production with caution.

DO please test your applications on this RC, as we would like to ensure that it remains backwards compatible, and that the migration path is smooth.

Changes in this version

Please see our post for 2.2.0rc1 and our post for 2.2.0rc2 for a list of changes. In addition to those changes, the following have been made:

• A late addition of Zend\Stdlib\Hydrator\Aggregate was made. This functionality allows the ability to map hydrators to objects via events, and generally streamlines the process of having a single hydrator for a hierarchy of objects. Read more in the AggregateHydrator documentation.

• Improvements were made to Zend\Di to make it work better with the various "Aware" interfaces that have proliferated throughout the framework, eliminating issues where the component would attempt to instantiate an interface.

Changelog

Almost 200 patches were applied for 2.2.0. We will not release a full changelog until we create the stable release. In the meantime, you can view a full set of patches applied for 2.2.0 in the 2.2.0 milestone on GitHub:

• Zend Framework 2.2.0 milestone

Thank You!

Please join me in thanking everyone who provided new features and code improvements for this upcoming 2.2.0 release!

Roadmap

This is the third release candidate. At this time, we anticipate a stable release sometime mid-week next week.

Over the next few days, we will be expanding on documentation, and fixing any critical issues brought to our attention; we do not anticipate many, if any, critical issues at this time, however.

Again, DO please test your applications on this RC, as we would like to ensure that it remains backwards compatible, and that the migration path is smooth.

• http://packages.zendframework.com/

This is a release candidate. It is not the final release, and while stability is generally considered good, there may still be issues to resolve between now and the stable release. Use in production with caution.

DO please test your applications on this RC, as we would like to ensure that it remains backwards compatible, and that the migration path is smooth.

Changes in this version

Please see our post for 2.2.0rc1 for a list of changes. In addition to those changes, the following have been made:

• A late change was made to eliminate and/or make optional several dependencies in Zend\Feed and Zend\Validator. While these are generally backwards compatible, we need to note that you can no longer directly use Zend\I18n\Translator\Translator with validators; instead, you must use Zend\Mvc\I18n\Translator. In most cases, this will not present an issue, as the translator object is generally injected via the ValidatorPluginManager, which has already been updated to inject the correct translator object.

  If you were manually injecting your validators with a translator object, please note that you must now use Zend\Mvc\I18n\Translator.

  The changes have some immediate benefits: you can now use Zend\Feed with third-party HTTP clients!

Changelog

Almost 200 patches were applied for 2.2.0. We will not release a full changelog until we create the stable release. In the meantime, you can view a full set of patches applied for 2.2.0 in the 2.2.0 milestone on GitHub:

• Zend Framework 2.2.0 milestone

Thank You!

Please join me in thanking everyone who provided new features and code improvements for this upcoming 2.2.0 release!

Roadmap

We plan to release additional RCs every 3-5 days until we feel the 2.2.0 release is generally stable; we anticipate a stable release sometime next week.

During the RC period, we will be expanding on documentation, and fixing any critical issues brought to our attention.

Again, DO please test your applications on this RC, as we would like to ensure that it remains backwards compatible, and that the migration path is smooth.

• http://packages.zendframework.com/

This is a release candidate. It is not the final release, and while stability is generally considered good, there may still be issues to resolve between now and the stable release. Use in production with caution.

DO please test your applications on this RC, as we would like to ensure that it remains backwards compatible, and that the migration path is smooth.

Changes in this version

• Addition of many more plugin managers and abstract service factories. In order to simplify usage of the ServiceManager as an Inversion of Control container, as well as to provide more flexibility in and consistency in how various framework components are consumed, a number of plugin managers and service factories were created and enabled.

  Among the various plugin managers created are Translator loader manager, a Hydrator plugin manager (allowing named hydrator instances), and an InputFilter manager.

  New factories include a Translator service factory, and factories for both the Session configuration and SessionManager.

  New abstract factories include one for the DB component (allowing you to manage multiple named adapters), Loggers (for having multiple Logger instances), Cache storage (for managing multiple cache backends), and Forms (which makes use of the existing FormElementsPluginManager, as well as the new Hydrator and InputFilter plugin managers).

• Data Definition Language (DDL) support in Zend\Db. DDL provides the ability to create, alter, and drop tables in a relational database system. Zend\Db now offers abstraction around DDL, and specifically MySQL and ANSI SQL-92; we will gradually add this capability for the other database vendors we support.

• Authentication: The DB adapter now supports non-RDBMS credential validation.
• Cache: New storage backend: Redis.
• Code: The ClassGenerator now has a removeMethod() method.
• Console: Incremental improvements to layout and colorization of banners and usage messages; fixes for how literal and non-literal matches are returned.
• DB: New DDL support (noted earlier); many incremental improvements.
• Filter: New DateTimeFormatter filter.
• Form: Many incremental improvements to selected elements; new FormAbstractServiceFactory for defining form services; minor improvements to make the form component work with the DI service factory.
• InputFilter: new CollectionInputFilter for working with form Collections; new InputFilterPluginManager providing integration and services for the ServiceManager.
• I18n: We removed ext/intl as a hard requirement, and made it only a suggested requirement; the Translator has an optional dependency on the EventManager, providing the ability to tie into "missing message" and "missing translations" events; new country-specific PhoneNumber validator.
• ModuleManager: Now allows passing actual Module instances (not just names).
• Navigation: Incremental improvements, particularly to URL generation.
• MVC: You can now configure the initial set of MVC event listeners in the configuration file; the MVC stack now detects generic HTTP responses when detecting event short circuiting; the default ExceptionStrategy now allows returning JSON; opt-in translatable segment routing; many incremental improvements to the AbstractRestfulController to make it more configurable and extensible; the Forward plugin was refactored to no longer require a ServiceLocatorAware controller, and instead receive the ControllerManager via its factory.
• Paginator: Support for TableGateway objects.
• ServiceManager: Incremental improvements; performance optimizations; delegate factories, which provide a way to write factories for objects that replace a service with a decorator; "lazy" factories, allowing the ability to delay factory creation invocation until the moment of first use.
• Stdlib: Addition of a HydratorAwareInterface; creation of a HydratorPluginManager.
• SOAP: Major refactor of WSDL generation to make it more maintainable.
• Validator: New Brazilian IBAN format for IBAN validator; validators now only return unique error messages; improved Maestro detection in CreditCard validator.
• Version: use the ZF website API for finding the latest version, instead of GitHub.
• View: Many incremental improvements, primarily to helpers; deprecation of the Placeholder Registry and removal of it from the implemented placeholder system; new explicit factory classes for helpers that have collaborators (making them easier to override/replace).

Changelog

Almost 200 patches were applied for 2.2.0. We will not release a full changelog until we create the stable release. In the meantime, you can view a full set of patches applied for 2.2.0 in the 2.2.0 milestone on GitHub:

• Zend Framework 2.2.0 milestone

Other Announcements

Around a month ago, we migrated Zend Framework 1 to GitHub. At that time, we also migrated active issues created since 1.12.0 to the GitHub issue tracker, and marked our self-hosted issue tracker read-only. We have decided to turn off that issue tracker, but still retain the original issues at their original locations for purposes of history and transparency. You can find information on the change on our issues landing page.

Thank You!

Please join me in thanking everyone who provided new features and code improvements for this upcoming 2.2.0 release!

Roadmap

We plan to release additional RCs every 3-5 days until we feel the 2.2.0 release is generally stable; we anticipate a stable release in the next 2-3 weeks.

During the RC period, we will be expanding on documentation, and fixing any critical issues brought to our attention.

Again, DO please test your applications on this RC, as we would like to ensure that it remains backwards compatible, and that the migration path is smooth.

• http://framework.zend.com/downloads/latest

This is a monthly maintenance release.

Notable changes

2.1.5 is a monthly maintenance release, and the bulk of issues resolved were primarily centered around code maintainability - docblocks typos were corrected, internal variables renamed more semantically, etc. However, a few changes are notable:

• A long-standing issue regarding setting global permissions in Zend\Permissions\Acl was resolved.
• Zend\Db\Metadata was updated to no longer use the untrusted quoteValue() API; this means it will no longer create notices!
• Filter priority settings are no longer lost when merging filter chains.
• The stop-propagation flag is now reset when triggering an event. This solves a problem that occurred in the MVC when triggering multiple different events in succession.
• A fix was applied to prevent Zend\Console from bleeding color to the next line.
• Zend\Navigation now supports query parameters properly.
• Forms now allow empty collections
• Zend\Navigation now properly injects pages with dependencies.

Manual improvements

Last month, we held our first documentation hunt, resulting in a lot of documentation improvements.

Additionally, we began an effort to provide Zend Framework 1 -> Zend Framework 2 migration information. A preview is available on readthedocs.org.

Changelog

Almost 100 patches were applied to the ZF2 codebase, and dozens to the documentation. The full changelog for 2.1.5 is available:

• http://framework.zend.com/changelog/2.1.5

Thank You!

I'd like to thank everyone who provided issue reports, typo fixes, maintenance improvements, bugfixes, and documentation improvements; your efforts make the framework increasingly better!

Roadmap

Maintenance releases happen monthly on the third Wednesday. Version 2.2.0 will release in the first half of May, with the first release candidate dropping during the week of 29 April - 3 May 2013.

First of all, you don't have to have a major in English literature to help us with the documentation. We, the contributors, come from all over the world and many of us use English as a second — or even third! — language, but that does not stop us from trying to improve the docs. Neither should it stop you.

We are not asking for much. Read a chapter or two, or even just a paragraph. Point us to parts of the documentation that are confusing, unclear, or not explained well enough. Would it be easier for you to understand a section if we would add a picture or two? Tell us. Do you want to see more code examples? Let us know. Pick a component that you use most often and work with the contributors to have the documentation for that component as clear as possible. Have something to add? Send a pull request.

We all learn in different ways, and while some documentation might be good for one developer, it might be confusing for another. That's why we are striving to have several different ways of presenting the material: reference manual, tutorials, user guides, API docs. Let us know what works best for you and we will do our best to make it happen.

We would like to ask you one thing, though. Any and all problems, requests, ideas you have that can help us improve the documentation, please report them on the documentation issue tracker on Github. Thanks!

If you'd like to start contributing to the documentation by submitting patches and improvements, the best place to start is to read the contributing guide.

Just so you know that we do really work on improving the documentation, a week or so ago we held our first dochunt. It was a weekend dedicated to improving the documentation and as you can see from the results quite a few fixes and improvements were made, thanks to those who participated. In the coming weeks, we will hold the next dochunt. This time we will try to strictly focus on writing new tutorial and improving existing ones, but any and all contributions are welcomed.

We don't know yet when the second dochunt will be held, but we will let you know. Until then, start reading through the manual, look for things to improve, keep a list of what's missing, and give us feedback!

The contributors and the Zend Framework team thank you!

As such, we will be migrating the ZF1 Subversion repository to GitHub this week. Please read on for details!

What will happen

Subversion Access

First: you will still have access to Subversion!

For versions prior to 1.12, we will continue hosting our current Subversion repository, and if you are using svn:externals with a tag or branch on that repository, that will continue to work. However, the repository will be read-only going forward.

The release-1.12 branch, however, will become the "master" branch on the GitHub repository. All future updates, including security fixes, will be made to this branch and this branch only; future tags will be made against GitHub. However, for those of you using Subversion, all is not lost: Github supports Subversion! (That's 2 separate links!)

If you are pointing your svn:externals at either trunk or the release-1.12 branch, you will need to update your svn:externals to point at the new repository location. To do this, you will execute the following:

[user@server]$ svn propedit svn:externals path/in/working-dir/to/zf1

This will spawn an editor. In that editor, change the URL for ZF1:

• "http://framework.zend.com/svn/framework/standard/trunk" becomes "https://github.com/zendframework/zf1/trunk"
• "http://framework.zend.com/svn/framework/standard/branches/release-1.12" becomes "https://github.com/zendframework/zf1/trunk"
• "http://framework.zend.com/svn/framework/standard/tags/release-1.12.*" become "https://github.com/zendframework/zf1/tags/release-1.12.*"

Once you have made this change, save and exit. Then run:

[user@server]$ svn commit -m "update externals"

svn:externals - Dojo

Currently, the ZF1 repository defines a single svn:externals property, which adds Dojo Toolkit.

Currently, this points to version 1.5 of Dojo, as that is the last version with which ZF1 maintained compatibility. We have decided with the move to GitHub to remove the svn:externals entry, and not add a git submodule; however, we will continue packaging Dojo 1.5 in any ZF1 releases.

If you relied on the svn:externals definition in ZF1 in order to obtain Dojo, you will need to add it to your repository yourself. If you need to do so, point the definition at "http://svn.dojotoolkit.org/src/branches/1.5".

"Extras" Repository

The "extras" repository, which contains the jQuery integration, Firebird DB adapter, and console process forking tools, will also be migrated to GitHub, following the same pattern as for the ZF1 repo (i.e., release-1.12 branch will become the master branch on the GitHub repository, and the old subversion repository will be marked read-only). You will need to update any svn:externals definitions just as you would for ZF1, with the following mappings:

• "http://framework.zend.com/svn/framework/extras/trunk" becomes "https://github.com/zendframework/zf1-extras/trunk"
• "http://framework.zend.com/svn/framework/extras/branches/release-1.12" becomes "https://github.com/zendframework/zf1-extras/trunk"

Issue Tracker

Since Zend Framework 1 is in maintenance mode at this time, we are only addressing critical or security issues. As such, we have decided to port only open issues created since 1.12.0 was released (at the time of this writing, around 66 issues) to GitHub issues.

The JIRA instance will be marked read-only. We will likely disable it in the near future; if we do so, we will likely provide static pages of all issues for later reference. (This item is still to be determined.)

Information on the new issue tracker location will be placed on the JIRA landing page, with links to each of the ZF1, ZF1 Extras, and ZF2 repositories.

Collaboration

Once the cutover occurs, only the Zend team and the Community Review team will have commit rights on the GitHub repository. This means that patches will need to be submitted as Pull Requests. Once submitted, members of these teams, as well as the general community, can comment and provide feedback; once consensus is reached that the patch is ready, it will be merged to the repository.

If you are unfamiliar with Git and/or GitHub, we recommend the following resources:

• GitHub help site, which details everything from setting up Git to creating and forking repositories, to collaborating.
• git-scm site, which provides a comprehensive, online book detailing basics to advanced features of Git.
• ZF2 Git Guide, which details the typical contributor workflow; simply substitute "zf1" for "zf2" in that guide. (We will likely add this to ZF1 soon as well.)

One note: at this point, we will only accept bug and security fixes; new features are not currently in scope for Zend Framework 1.

Important! You will still need to have a Contributors License Agreement (CLA) on file for us to accept your contributions. For this reason, we recommend setting your user.email git configuration setting to the same email used for your CLA; with this information, we can easily look up your CLA status, which will expedite our ability to merge your pull requests/patches. To do this, simply execute the following from within your ZF1 checkout:

[user@server]$ git config user.email "your-email@example.com"

Do this prior to making any commits, to ensure that the commits in your patch are attributed to that email.

Timeline

The plan at this time is to mark the ZF1 subversion repository and issue tracker read-only starting Friday, 5 April 2013.

Future

The repository and issues migration is the first step in a series of planned migrations. We also plan to eventually migrate our wiki to GitHub; this will allow us to offload functionality from the main ZF website, and also consolidate all development-related functionality (other than the mailing list) in a central location.

If you have any concerns, please feel free to contact myself, my team, or the Community Review Team.

• http://framework.zend.com/downloads/latest

The ZF2 releases include three security updates, and all ZF versions also include updates to the Twitter component to follow the Twitter v1.1 API, which is not backwards compatible with previous versions.

Security Fixes

2.1.4 and 2.0.8 contain three security fixes.

Query Route

We were alerted to the fact that the Query route could override parameters matched in parent routes, effectively bypassing constraints defined. In particular, this could result in overriding the controller or action matched by a given route.

The query route was deprecated, as a replacement exists within the HTTP router itself. You can pass a "query" option to the assemble method containing either the query string or an array of key-value pairs:

<?php
$url = $router->assemble(array(
    'name' => 'foo',
), array(
    'query' => array(
        'page' => 3,
        'sort' => 'DESC',
    ), 
    // or: 'query' => 'page=3&sort=DESC'
));

// via URL helper/plugin:
$rendererOrController->url('foo', array(), array('query' => $request->getQuery()));

Additionally, the merging of query parameters into the route match was removed entirely. Please use the query container of the request object instead.

For more information on the security vector, please see ZF2013-01.

Random Number Generation

The Zend\Math\Rand component generates random bytes using the OpenSSL or Mcrypt extensions when available but will otherwise use PHP's mt_rand() function as a fallback. All outputs from mt_rand() are predictable for the same PHP process if an attacker can brute force the seed - which can be done if the attacker has access to a random number generated by `mt_rand` or the session ID (if generated without using additional entropy).

Zend Framework have revised the Zend\Math\Rand component to replace the current mt_rand() fallback for OpenSSL/Mcrypt with Anthony Ferrara's RandomLib, incorporating an additional entropy source based on source code published by George Argyros. The new fallback collects entropy from numerous sources other than PHP's internal seed mechanism and extracts random bytes from the resulting mixed entropy pool.

For more information on this security vector, please see ZF2013-02.

Database Platform Quoting

Altered Zend\Db to throw notices when insecure usage of the following methods is called:

• Zend\Db\Adapter\Platform\*::quoteValue*()
• Zend\Db\Sql\*::getSqlString*()

Fixed Zend\Db Platform objects to use driver level quoting when provided, and throw E_USER_NOTICE when not provided. Added quoteTrustedValue() API for notice-free value quoting. Fixed all userland quoting in Platform objects to handle a wider array of escapable characters.

For more information on this security vector, please see ZF2013-03.

Twitter API Updates

Twitter has begun sunsetting its v1.0 API, and has introduced rolling blackouts in order to prompt developers to move to the v1.1 API. Unfortunately, v1.1 is not backwards compatible with v1.0, so a number of backwards-breaking changes need to be made.

Version 2.1.0 of ZendService_Twitter and version 1.12.3 of Zend Framework have been released with support for v1.1 of the Twitter API. A number of service endpoints were removed, and others moved to new namespaces. As such, if you use the component, you are urged to upgrade, and we encourage you to read the documentation to see what methods are now available, and how to use OAuth access tokens with the service.

Polyfill Support Fixes

Polyfills (version-specific class replacements) have caused some issues in the 2.1 series for users of Zend\Stdlib and Zend\Session. In particular, users who were not using Composer were unaware/uncertain about what extra files needed to be included to load polyfills, and those users who were generating classmaps were running into issues since the same class was being generated twice.

New polyfill support was created which does the following:

• New, uniquely named classes were created for each polyfill base.
• A stub class file was created for each class needing polyfill support. A conditional is present in each that uses class_alias to alias the appropriate polyfill base as an import. The stub class then extends the base.
• The compatibility/autoload.php file in each component affected was altered to trigger an E_USER_DEPRECATED error asking the user to remove the require statement for the file.

The functionality works with both Composer and ZF2's autoloading support, using either PSR-0 or classmaps. All typehinting is preserved.

Changelog

Below are links to the changelogs for each version.

• 2.1.4 Changelog
• 2.0.8 Changelog
• 1.12.3 Changelog

Thank You!

I'd like to thank our main contributors to this release. In particular, Pádraic Brady and Enrico Zimuel for researching and implementing the Random Number Generator vulnerability and fixes; Ben Scholzen for implementing fixes for the Query route; Ralph Schindler, for his fixes for the database platform quoting vulnerabilities; and Mike Willbanks, for continuing to work on solutions for session storage and timing issues.

Roadmap

Maintenance releases happen monthly on the third Wednesday; expect version 2.1.5 to drop 17 April 2013. We're also gearing up for version 2.2.0, which we are targetting at the end of April 2013/early May.

• http://framework.zend.com/downloads/latest

Changelog

This release includes almost 50 bugfixes and stability fixes. In particular, a fix was released for Zend_Service_Twitter, ensuring that it will continue to work with the Twitter API going forward. If you are using the Zend_Service_Twitter component, please upgrade immediately, or your code will not work!

To see the complete set of issues resolved for 1.12.2, please visit the changelog:

• http://framework.zend.com/changelog/1.12.2

Thank You!

Many thanks to all contributors to this release!

• http://framework.zend.com/downloads/latest

This release has been pushed out quickly on the heels of 2.1.2 to fix an issue with autoloading PHP version-specific class implementations that was affecting PHP 5.3.3 users. Two other potential regressions were also addressed.

PHP 5.3.3 Users

This release finally resolves issues with providing PHP version-specific classes, specifically for PHP 5.3.3 users.

If you are using Composer to manager your dependencies, a composer.phar update should resolve any issues.

If you are not, you have two options.

First, when starting new applications with the ZendSkeletonApplication, class substitution will now happen by default.

Otherwise, add the following lines to your init_autoloader.php file, as indicated by the comments below:

<?php
// The following line should be on or around line 34:
if ($zf2Path) {
    if (isset($loader)) {
        $loader->add('Zend', $zf2Path);
    } else {
        include $zf2Path . '/Zend/Loader/AutoloaderFactory.php';
        Zend\Loader\AutoloaderFactory::factory(array(
            'Zend\Loader\StandardAutoloader' => array(
                'autoregister_zf' => true
            )
        ));

        // Add the following two lines:
        require $zf2Path . '/Zend/Stdlib/compatibility/autoload.php';
        require $zf2Path . '/Zend/Session/compatibility/autoload.php';
    }
}

Routing Fixes

Two fixes to routing were made after discovering potential regressions.

The first was to hostname routing. Changes were introduced in 2.1.2 to make matching optional nested subdomains possible; unfortunately, this broke cases where the primary domain was specified. A fix has been included in 2.1.3 that fixes the regression (while simultaneously allowing the new behavior).

A bug in console routing was also uncovered; camelCased or MixedCase options were allowed in route definitions, but route matching was normalizing options to lowercase, causing false negative matches. This was fixed for 2.1.3.

Changelog

Below are links to the issues addressed.

• 3714: Zend\Stdlib\ArrayObject::offsetExists() returning by reference
• 3855: Fix #3852
• 3856: Simple route case insensitive

Thank You!

I'd like to thank those that tested the PHP 5.3.3 autoloading fixes, as well as Nick Calugar for providing the fix to hostname routing and Michael Gallego for the fixes to console routing.

Roadmap

Maintenance releases happen monthly on the third Wednesday; expect version 2.1.4 to drop 20 March 2013. We're also gearing up for version 2.2.0, which we are targetting at the end of April 2013.